<html xmlns:th="http://www.thymeleaf.org">

<script th:src="@{/lesson_js/xxe.js}" language="JavaScript"></script>

<div class="lesson-page-wrapper">
    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
    <!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
    <div class="adoc-content" th:replace="doc:XXE_plan.adoc"></div>
</div>

<div class="lesson-page-wrapper">
    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
    <!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
    <div class="adoc-content" th:replace="doc:XXE_intro.adoc"></div>
</div>

<div class="lesson-page-wrapper">
    <div class="adoc-content" th:replace="doc:XXE_simple.adoc"></div>
    <link rel="stylesheet" type="text/css" th:href="@{/lesson_css/xxe.css}"/>
    <div class="attack-container">
        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>

        <form class="attack-form" accept-charset="UNKNOWN"
              method="POST" name="form"
              prepareData="simpleXXE"
              successCallback="simpleXXECallback"
              failureCallback="simpleXXECallback"
              contentType="application/xml"
              action="/WebGoat/xxe/simple">
            <div class="container-fluid">
                <div class="panel post">
                    <div class="post-heading">
                        <div class="pull-left image">
                            <img th:src="@{/images/avatar1.png}"
                                 class="img-circle avatar" alt="user profile image"/>
                        </div>
                        <div class="pull-left meta">
                            <div class="title h5">
                                <a href="#"><b>John Doe</b></a>
                                uploaded a photo.
                            </div>
                            <h6 class="text-muted time">24 days ago</h6>
                        </div>
                    </div>

                    <div class="post-image">
                        <img th:src="@{images/cat.jpg}" class="image" alt="image post"/>
                    </div>

                    <div class="post-description">

                    </div>
                    <div class="post-footer">
                        <div class="input-group">
                            <input class="form-control input-lg" id="commentInputSimple" placeholder="Add a comment"
                                   type="text"/>
                            <span class="input-group-addon">
                                <button id="postCommentSimple" class="btn btn-primary">Submit</button>
                            </span>
                        </div>
                        <ul class="comments-list">
                            <div id="commentsListSimple">
                            </div>
                        </ul>
                    </div>
                </div>
            </div>
        </form>

        <br/>
        <div class="attack-feedback"></div>
        <div class="attack-output"></div>
    </div>
</div>

<div class="lesson-page-wrapper">
    <div class="adoc-content" th:replace="doc:XXE_changing_content_type.adoc"></div>
    <div class="attack-container">
        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
        <form class="attack-form" accept-charset="UNKNOWN"
              method="POST" name="form"
              prepareData="contentTypeXXE"
              successCallback="contentTypeXXECallback"
              failureCallback="contentTypeXXECallback"
              action="xxe/content-type"
              contentType="application/json">
            <div class="container-fluid">
                <div class="panel post">
                    <div class="post-heading">
                        <div class="pull-left image">
                            <img th:src="@{/images/avatar1.png}"
                                 class="img-circle avatar" alt="user profile image"/>
                        </div>
                        <div class="pull-left meta">
                            <div class="title h5">
                                <a href="#"><b>John Doe</b></a>
                                uploaded a photo.
                            </div>
                            <h6 class="text-muted time">24 days ago</h6>
                        </div>
                    </div>

                    <div class="post-image">
                        <img th:src="@{images/cat.jpg}" class="image" alt="image post"/>
                    </div>

                    <div class="post-description">

                    </div>
                    <div class="post-footer">
                        <div class="input-group">
                            <input class="form-control input-lg" id="commentInputContentType" placeholder="Add a comment"
                                   type="text"/>
                            <span class="input-group-addon">
                                <button id="postCommentContentType" class="btn btn-primary">Submit</button>
                            </span>
                        </div>
                        <ul class="comments-list">
                            <div id="commentsListContentType">
                            </div>
                        </ul>
                    </div>
                </div>
            </div>
        </form>

        <br/>
        <div class="attack-feedback"></div>
        <div class="attack-output"></div>
    </div>
</div>


<div class="lesson-page-wrapper">
    <div class="adoc-content" th:replace="doc:XXE_overflow.adoc"></div>
</div>

<div class="lesson-page-wrapper">
    <div class="adoc-content" th:replace="doc:XXE_blind.adoc"></div>
</div>

<div class="lesson-page-wrapper">
    <div class="adoc-content" th:replace="doc:XXE_blind_assignment.adoc"></div>
    <div class="attack-container">
        <img th:src="@{/images/wolf-enabled.png}" class="webwolf-enabled"/>
        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
        <form class="attack-form" accept-charset="UNKNOWN"
              method="POST" name="form"
              prepareData="blindXXE"
              successCallback="blindXXECallback"
              failureCallback="blindXXECallback"
              action="/WebGoat/xxe/blind"
              contentType="application/xml">
            <div class="container-fluid">
                <div class="panel post">
                    <div class="post-heading">
                        <div class="pull-left image">
                            <img th:src="@{/images/avatar1.png}"
                                 class="img-circle avatar" alt="user profile image"/>
                        </div>
                        <div class="pull-left meta">
                            <div class="title h5">
                                <a href="#"><b>John Doe</b></a>
                                uploaded a photo.
                            </div>
                            <h6 class="text-muted time">24 days ago</h6>
                        </div>
                    </div>

                    <div class="post-image">
                        <img th:src="@{images/cat.jpg}" class="image" alt="image post"/>
                    </div>

                    <div class="post-description">

                    </div>
                    <div class="post-footer">
                        <div class="input-group">
                            <input class="form-control input-lg" id="commentInputBlind" placeholder="Add a comment" type="text"/>
                            <span class="input-group-addon">
                                <button id="postCommentBlind" class="btn btn-primary">Submit</button>
                            </span>
                        </div>
                        <ul class="comments-list">
                            <div id="commentsListBlind">
                            </div>
                        </ul>
                    </div>
                </div>
            </div>
        </form>

        <br/>
        <div class="attack-feedback"></div>
        <div class="attack-output"></div>
    </div>
</div>


<div class="lesson-page-wrapper">
    <div class="adoc-content" th:replace="doc:XXE_mitigation.adoc"></div>
</div>


</html>